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Abstract 


This document describes the algorithms and presents test vectors for 
the Camellia block cipher algorithm in Counter mode (CTR) and Counter 
with Cipher Block Chaining MAC mode (CCM). The purpose of this 
document is to make the Camellia-CTR and Camellia-CCM algorithm 
conveniently available to the Internet Community. 
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1. Introduction 


This document describes the use of the Camellia block cipher 
algorithm in Counter (CTR) mode and Counter with CBC-MAC (CCM) mode. 


Camellia is a symmetric cipher with a Feistel structure.  Camellia 
was developed jointly by NTT and Mitsubishi Electric Corporation in 
2000. It was designed to withstand all known cryptanalytic attacks, 
and it has been scrutinized by worldwide cryptographic experts. 
Camellia is suitable for implementation in software and hardware, 
offering encryption speed in software and hardware implementations 
that is comparable to Advanced Encryption Standard (AES) [5]. 


Camellia supports 128-bit block size and 128-, 192-, and 256-bit key 
lengths, i.e., the same interface specifications as the AES. 
Therefore, it is easy to implement Camellia-based algorithms by 
replacing the AES block of AES-based algorithms with a Camellia 
block. 


Camellia already has been adopted by the IETF and other international 
standardization organizations; in particular, the IETF has published 
Specifications for the use of Camellia with IPsec [6], TLS [7], 
Secure/Multipurpose Internet Mail Extensions (S/MIME) [8], and XML 
Securiy [9]. Camellia is one of the three ISO/IEC international 
standard [10] 128-bit block ciphers (Camellia, AES, and Super 
Effective and Efficient Delivery (SEED)). Camellia was selected as a 
recommended cryptographic primitive by the EU NESSIE (New European 
Schemes for Signatures, Integrity and Encryption) project [11] and 


Kato, et al. Informational [Page 2] 


RFC 5528 Camellia-CTR and Camellia-CCM algorithms April 2009 


was included in the list of cryptographic techniques for Japanese 
e-Government systems that was selected by the Japanese CRYPTREC 
(Cryptography Research and Evaluation Committees) [12]. 


Since optimized source code is provided under several open source 
licenses [13], Camellia has also been adopted by several open source 
projects (OpenSSL, FreeBSD, Linux, and Firefox). 


The algorithm specification and object identifiers are described in 
felt Ts 


The Camellia web site [14] contains a wealth of information about 
Camellia, including detailed specification, security analysis, 
performance figures, reference implementation, optimized 
implementation, test vectors (TVs), and intellectual property 
information. 


1.1. Terminology 
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 


document are to be interpreted as described in RFC 2119 [2]. 


All multi-octet values in this document are encoded and represented 
in network byte order, i.e., most significant octet first. 


2. The Camellia Cipher Algorithm 
All symmetric block cipher algorithms share common characteristics 
and variables, including mode, key size, weak keys, and block size. 
The following sections contain descriptions of the relevant 
characteristics of Camellia. 

2.1. Key Size 
Camellia supports three key sizes: 128 bits, 192 bits, and 256 bits. 
The default key size is 128 bits, and all implementations MUST 
support this key size. Implementations MAY also support key sizes of 
192 bits and 256 bits. 

2.2. Weak Keys 


At the time of writing this document, there are no known weak keys 
for Camellia. 


2.3. Block Size and Padding 


Camellia uses a block size of 16 octets (128 bits). 
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Padding is required by the algorithm to maintain a 16-octet (128-bit) 
block size.  Padding MUST be added such that the data to be encrypted 
has a length that is a multiple of 16 octets. 


Because of the algorithm-specific padding requirement, no additional 
padding is required to ensure that the ciphertext terminates on a 
4-octet boundary (i.e., maintaining a 16-octet block size guarantees 
that the Encapsulating Security Payload (ESP) Pad Length and Next 
Header fields will be right aligned within a 4-octet word). 
Additional padding MAY be included as long as the 16-octet block size 
is maintained. 


2.4. Performance 
Performance figures for Camellia are available at [14]. The NESSIE 
project has reported on the performance of optimized implementations 
independently [11]. 


3. Modes of Operation 


Camellia Counter (Camellia-CTR) mode and Camellia Counter with CBC- 
MAC (Camellia-CCM) mode are based on [3][15][4]. 


CTR mode [3] behaves like a stream cipher, but is based on a block 
cipher primitive (that is, CTR mode operation of a block cipher 


results in a stream cipher). 


CCM mode [15][4] is a generic authenticate-and-encrypt block cipher 


mode. In this specification, CCM is used with the Camellia [1] block 
cipher. 
4. Test Vectors 


4.1.  Camellia-CTR 


This section contains nine TVs, which can be used to confirm that an 
implementation has correctly implemented Camellia-CTR. The first 
three TVs use Camellia with a 128-bit key; the next three TVs use 
Camellia with a 192-bit key; and the last three TVs use Camellia with 
a 256-bit key. 
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Camellia-CTR with 


CC 4B F7 A5 
00 


62 6C 6F 
00 00 00 
F8 4C E8 
9A 20 87 


63 
00 
1F 
7C 


Camellia-CTR with 


D7 43 D6 CE 
0B 


07 08 
17 18 
59 DA 
D3 D2 
59 DA 
BO 34 
D4 DA 
A7 2C 


09 
1:9 
48 
YS 
48 
6D 
7C 
74 


0A 
1A 
D9 
9A 
D9 
OD 
90 
1 


Camellia-CTR with 


A8 AC 6E 61 
FO 


07 08 
17 18 


09 
19 


0A 
1A 


3F 4A 
8F 27 
3F 4A 
E6 57 
3F 4A 
53 6A 
88 2F 
Fl 4F 


T3 
8D 
TI 
34 
17 
9D 
84 
2D 


86 
96 
86 
47 
86 
10 
9€ 
5D 


Camellia-CTR with 


TV 41: Encrypting 16 octets using 
Camellia Key : AE 68 52 F8 12 10 67 
Camellia-CTR IV 00 00 00 00 00 00 00 
Nonce 00 00 00 30 
Plaintext : 53 69 6E 67 6C 65 20 
Counter Block (1): 00 00 00 30 00 00 00 
Key Stream (1): 83 FA AC FD EE 71 41 
Ciphertext : DO 9D C2 9A 82 14 61 
TV 424 Hnecypeing. 32 octets using 
Camellia Key 7E 24 06 78 17 FA EO 
Camellia-CTR IV CO 54 3B 59 DA 48 D9 
Nonce 00 6C B6 DB 
Plaintext 00 01 02 03 04 05 06 
10 11 12 13 14 15 16 
Counter Block (1): 00 6C B6 DB CO 54 3B 
Key Stream (1): DB F2 C5 8E C4 86 90 
Counter Block (2): 00 6C B6 DB CO 54 3B 
Key Stream (2): 3B 9F 9C 1C 25 E5 CA 
Ciphertext DB F3 C7 8D CO 83 96 
2B 8E 8E OF 31 FO DC 
TV 43: PRetypting. 36 octets using 
Camellia Key 76 91 BE 03 5E 50 20 
Camellia-CTR IV 27 77 7F 3F 4A 17 86 
Nonce 00 EO 01 7B 
Plaintext 00 01 02 03 04 05 06 
10 11 12 13 14 15 16 
20 21 22 23 
Counter Block (1): 00 EO 01 7B 27 77 7F 
Key Stream (1): B1 9C 1D CE CF 70 ED 
Counter Block (2): 00 EO 01 7B 27 77 7F 
Key Stream (2): 8C F7 59 38 48 88 65 
Counter Block (3): 00 EO 01 7B 27 77 7F 
Key Stream (3): FF 71 A4 B5 D8 86 12 
Ciphertext Bl 9D 1F CD CB 75 EB 
9C E6 4B 2B 5C 9D 73 
DF 50 86 96 
TV 44: BHG Ea EKS 16 octets using 
Camellia Key 16 AF 5B 14 5F C9 F5 
86 3D 06 CC FD B7 85 
Camellia-CTR IV 36 73 3C 14 7D 6D 93 
Nonce 00 00 00 48 
Plaintext : 53 69 6E 67 6C 65 20 
Counter Block (1): 00 00 00 48 36 73 3C 
Key Stream (1): 70 10 57 F9 E6 E8 OB 
Ciphertext 23 79 39 9E 8A 8D 2B 
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T9. QI. 75 F9 
15 
CB 


62 6C 6F 
14 7D 6D 
49 7A 1F 
2B 16 70 


63 
93 
4C 
2F 


128-bit key 
76 55 77 F3 


6B 20 6D 
00 00 00 
1D FB 72 
76 DB 1F 


73 
00 
78 
0B 


128-bit key 
1F 32 53 91 


0c 
1C 
00 
69 
00 
4F 
65 
53 


OD 
1D 
00 
B6 
00 
7D 
BB 
60 


OE 
1E 
00 
€5 
00 
FE 
CB 
EO 


128-bit key 
85 29 F9 AO 


0B 
1B 


UC 
1C 


OD 
1D 


OE 
1E 


FO 
E9 
FO 
86 
FO 
Al 
E2 
9D 


00 
41 
00 
D2 
00 
13 
4D 
CE 


00 
88 
00 
85 
00 
OF 
85 
98 


00 
C1 
00 
97 
00 
14 
CF 
89 


192-bit key 
3E 3B FB OE 


6B 20 6D 
CB 00 00 
AC AB F3 
C7 8B 9E 


73 
00 
ES 
96 
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9E 


67 
01 
58 
3F 


63 


OF 
1F 
01 
4B 
02 
57 
44 
48 


DC 


OF 
1F 


01 
7C 
02 
D2 
03 
F8 
73 
CD 


ED 


67 
01 
F1 
96 
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TV #5: Encrypting 32 octets using Camellia-CTR with 192-bit key 

Camellia Key : 7C 5C B2 40 1B 3D C3 3C 19 E7 34 08 19 EO F6 
67 8C 3D B8 E6 F6 A9 1A 

Camellia-CTR IV 02 0C 6E AD C2 CB 50 OD 

Nonce 00 96 BO 3B 

Plaintext 000102 03 04 05 06 07 08 09 OA OB OC OD OE 
10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D IE 

Counter Block (1): 00 96 BO 3B 02 OC 6E AD C2 CB 50 OD 00 00 00 

Key Stream (1): 7D EE 36 F4 Al D5 E2 12 6F 42 75 F7 A2 6A C9 

Counter Block (2): 00 96 BO 3B 02 OC 6E AD C2 CB 50 OD 00 00 00 

Key Stream (2): CO 09 AA 7C E6 25 47 F7 4E 20 30 82 EF 47 52 

Ciphertext 7D EF 34 F7 A5 DO E4 15 67 4B 7F FC AE 67 C7 
DO 18 B8 6F F2 30 51 EO 56 39 2A 99 F3 5A 4C 

TV #6: Encrypting 36 octets using Camellia-CTR with 192-bit key 

Camellia Key : 02 BF 39 1E E8 EC B1 59 B9 59 61 7B 09 65 27 
F5 9B 60 A7 86 D3 EO FE 

Camellia-CTR IV 5C BD 60 27 8D CC 09 12 

Nonce 00 07 BD FD 

Plaintext 000102 03 04 05 06 07 08 09 OA OB OC OD OE 
L0 lI1.12-L3.14 15.16. 17 - 18: 19 TAS IB. LG OLD: LE 
20 21 22 23 

Counter Block (1): 00 07 BD FD 5C BD 60 27 8D CC 09 12 00 00 00 

Key Stream (1) 57 11 E7 55 E5 4D 7C 27 BD A5 04 78 FD 93 40 

Counter Block (2): 00 07 BD FD 5C BD 60 27 8D CC 09 12 00 00 00 

Key Stream (2): 66 E2 6D CF 85 A4 F9 5A 55 B4 F2 FD 7A BB 53 

Counter Block (3): 00 07 BD FD 5C BD 60 27 8D CC 09 12 00 00 00 

Key Stream (3): F5 76 89 74 63 52 A8 C5 1E 82 DE 66 C3 9F 38 

Ciphertext : 57 10 E5 56 E1 48 7A 20 B5 AC OE 73 F1 9E 4E 
76 F3 7F DC 91 B1 EF 4D 4D AD E8 E6 66 A6 4D 
D5 57 AB 57 

TV #7: Encrypting 16 octets using Camellia-CTR with 256-bit key 

Camellia Key : 77 6B EF F2 85 1D BO 6F 4C 8A 05 42 C8 69 6F 
6A 81 AF 1E EC 96 B4 D3 7F C1 D6 89 E6 C1 Cl 

Camellia-CTR IV DB 56 72 C9 7A A8 FO B2 

Nonce 00 00 00 60 

Plaintext : 53 69 6E 67 6C 65 20 62 6C 6F 63 6B 20 6D 73 

Counter Block (1): 00 00 00 60 DB 56 72 C9 7A A8 FO B2 00 00 00 

Key Stream (1): 67 68 97 AF 48 1B DF AC D1 06 F7 1A 6C 76 C8 

Ciphertext 34 01 F9 C8 24 7E FF CE BD 69 94 71 4C 1B BB 
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TV #8: Encrypting 32 octets using Camellia-CTR with 256-bit key 


Camellia Key : F6 D6 6D 6B D5 2D 59 BB 07 96 36 58 79 EF F8 86 
: C6 6D D5 1A 5B 6A 99 74 4B 50 59 0C 87 A2 38 84 

Camellia-CTR IV : C1 58 5E F1 5A 43 D8 75 

Nonce : 00 FA AC 24 


Plaintext : 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 

: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 
Counter Block (1) 00 FA AC 24 C1 58 5E F1 5A 43 D8 75 00 00 00 01 
Key Stream (1): D6 C201 91 20 6A 7E OF AO 35 21 29 A4 8E 90 4A 
Counter Block (2): 00 FA AC 24 C1 58 5E F1 5A 43 D8 75 00 00 00 02 
Key Stream (2): F5 OD C6 99 08 CA 56 79 A4 85 D8 C8 B7 9E 5F 17 
Ciphertext : D6 C3 03 92 24 6F 78 08 A8 3C 2B 22 A8 83 9E 45 

: E5 1C D4 8A 1C DF 40 6E BC 9C C2 D3 AB 83 41 08 


TV #9: Encrypting 36 octets using Camellia-CTR with 256-bit key 


Camellia Key : FF 7A 61 7C E6 91 48 EA F1 72 6E 2F 43 58 1D E2 
: AA 62 D9 F8 05 53 2E DF F1 EE D6 87 FB 54 15 3D 
Camellia-CTR IV : 51 A5 1D 70 Al C1 11 48 
Nonce : 00 1C C5 B7 
Plaintext : 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 
S Ha ULO12-13.14 15.16. 17. 18:19 1A 1B. 1C 1D: LE LIKE 
20 21 22 23 


Counter Block (1): 00 1C C5 B7 51 A5 1D 70 A1 C1 11 48 00 00 00 01 
Key Stream (1) A4 DB 21 FF E2 AO F9 AD 65 6D A4 91 OA 5F AA 23 
Counter Block (2): 001C C5 B7 51 A5 1D 70 Al C1 11 48 00 00 00 02 
Key Stream (2): C1 70 B1 58 71 EC 71 88 6D D9 05 OB 03 6C 39 70 
Counter Block (3): 00 1C C5 B7 51 A5 1D 70 Al C1 11 48 00 00 00 03 
Key Stream (3): 35 CE 2F AE 90 78 B3 72 F5 76 12 39 1F 8B AF BF 
Ciphertext : A4 DA 23 FC E6 A5 FF AA 6D 64 AE 9A 06 52 A4 2C 

: D1 61 A3 4B 65 F9 67 9F 75 CO 1F 10 1F 71 27 6F 


15 EF OD 8D 
4.2.  Camellia-CCM 


This section contains twenty four TVs, which can be used to confirm 
that an implementation has correctly implemented Camellia-CCM. In 
each of these TVs, the least significant sixteen bits of the counter 
block is used for the block counter, and the nonce is 13 octets. 
Some of the TVs include an eight octet authentication value, and 
others include a ten octet authentication value. 
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Packet Vector #1 
CAM Key: C0. Cl (€2-C3. £04 C5 COUCH a 'C9°-CA, CB: CC CD CE-CE 
Nonce - 00 00 00 03 02 01 00 AO Al A2 A3 A4 A5 
Total packet length = 31. [Input (8 cleartext header octets) ] 
00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 
10 11 12 13. 14 15. l6 17 18-19 IA 1B. 1C 1D IE 
CBC IV in: 59 00 00 00 03 02 01 00 AO Al A2 A3 A4 A5 00 17 
CBC IV out:D4 DB CD 92 A8 96 41 56 1D OD BB DO D5 7F 7E 1D 
After xor: D4 D3 CD 93 AA 95 45 53 1B OA BB DO D5 7F 7E 1D [hdr] 
After CAM: BD 84 03 80 73 59 37 B7 CE F5 E4 BA 1B 18 54 DC 
After xor: B5 8D 09 8B 7F 54 39 B8 DE E4 F6 A9 OF OD 42 CB [msg] 
After CAM: CE 21 82 9C F6 F2 4D A2 CB 35 D1 FD 81 27 63 EC 
After xor: D6 38 98 87 EA EF 53 A2 CB 35 D1 FD 81 27 63 EC [msg] 
After CAM: 20 11 FE E2 53 B1 A7 DB 02 77 FA 37 6D 78 EE 10 
MIC tag : 20 11 FE E2 53 Bl A7 DB 
CTR Start: 01 00 00 00 03 02 01 00 AO Al A2 A3 A4 A5 00 01 
CTR[0001]: B2 7A 7B 8E EB 14 3F OB 82 E2 98 4C 06 44 CC 42 
CTR[0002]: E2 E2 D3 52 98 97 13 45 D1 63 22 90 E7 F8 15 4A 
CTR[MIC ]: DC BF 30 96 38 8C 1E 76 
Total packet length - 39. [Encrypted] 
00 01 02 03 04050607 BA 73 71 85 E7 19 31 04 
92 F3 8A 5F 12 51 DA 55 FA FB C9 49 84 8A OD FC 
AE CE 74 6B 3D B9 AD 


Packet Vector #2 


CAM Key: CO C1C2 C3 CA C5 C6 C7 C8 C9 CA CB CC CD CE CF 
Nonce - 00 00 00 04 03 02 01 AO Al A2 A3 A4 A5 
Total packet length = 32. [Input (8 cleartext header octets) ] 


00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 

10 11-12-13 .T4 15 16 17 I8 I9 1A 1B. IC-1D IE -LE 
CBC IV in: 59 00 00 00 04 03 02 01 AO Al A2 A3 A4 A5 00 18 
CBC IV out:07 OB 22 50 8A 24 3C DD 5B BA 54 DB 60 52 88 06 
After xor: 07 03 22 51 88 27 38 D8 5D BD 54 DB 60 52 88 06 [hdr] 
After CAM: 10 FD C2 F2 90 4A 9F 96 BO 4F 62 A4 A1 A9 31 1E 
After xor: 18 FA C8 F9 9C 47 91 99 AO 5E 70 B7 B5 BC 27 09 [msg] 
After CAM: E4 C8 82 02 89 55 5C 15 CE 7F E4 60 B1 B9 5A 08 
After xor: FC D1 98 19 95 48 42 OA CE 7F E4 60 B1 B9 5A 08 [msg] 
After CAM: D2 96 BA 4F 83 DE B5 DF A2 19 08 F7 47 4E 3C 40 
MIC tag : D2 96 BA 4F 83 DE B5 DF 
CTR Start: 01 00 00 00 04030201 AO Al A2 A3 A4 AS 00 01 
CTR[0001]: 55 2C 6E B4 82 A2 EF D6 85 37 FE 12 79 OE E6 55 
CTR[0002]: 54 E2 C8 D6 7E 99 91 2C F2 8A D7 8E 83 04 10 36 
CTR[MIC ]: B2 24 9312 71 9C 36 37 
Total packet length = 40. [Encrypted] 

00 01 02 03 04050607 5D 25 64 BF 8E AF El D9 

95 26 EC 01 6D 1B F0 42 4C FB D2 CD 62 84 8F 33 

60 B2 29 5D F2 42 83 E8 
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Packet Vector #3 


CAM Key: C0. Cl C2 C3. CA C5.C6..C7 C8 C9 .CA CB CC CD CE-CE 
Nonce - 00 00 00 05 04 03 02 AO Al A2 A3 A4 A5 
Total packet length = 33. [Input (8 cleartext header octets) ] 


00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 

L0 11 12-13. $4 15:16 17 18 19 1A 1B Le. 1D. 1E LE 

20 
CBC IV in: 59 00 00 00 0504 0302 AO Al A2 A3 A4 A5 00 19 
CBC IV out:6F 69 15 DF A6 AO DF 24 84 A7 37 88 A3 65 F9 2E 
After xor: 6F 61 15 DE A4 A3 DB21 82 A037 88 A3 65 F9 2E [hdr] 
After CAM: 59 5D 99 48 79 04 DA C9 13 93 36 C9 11 A8 09 1D 
After xor: 51 54 93 43 75 09 D4 C6 03 82 24 DA 05 BD 1F OA [msg] 
After CAM: 1A 43 D7 19 65 43 97 C1 43 6F 4F 11 AT 6C 6B ED 
After xor: 02 5A CD 02 79 5E 89 DE 63 6F 4F 11 A7 6C 6B ED [msg] 
After CAM: 30 0B 06 8A AO D1 4D C5 9E 44 22 84 82 45 42 OB 
MIC tag : 30 0B 06 8A AO D1 4D C5 
CTR Start: 01 00 00 00 0504 0302 AO Al A2 A3 A4 AS 00 01 
CTR[0001]: 89 FF 69 DD CB 75 76 18 E9 31 24 1B AD 97 BB 02 
CTR[0002]: C4 32 A7 9C CB 4B E9 8D 24 A8 FO AB C6 87 16 11 
CTR[MIC ]: C5 5A DO E2 8F F2 E7 83 
Total packet length = 41. [Encrypted] 

00 01 02 03 04050607 81 F6 63 D6 C7 78 78 17 

F9 20 36 08 B9 82 AD 15 DC 2B BD 87 D7 56 F7 92 

04 F5 51 D6 68 2F 23 AA 46 


Packet Vector #4 
CAM Key: Iei T e T C2 C3 (04 C5 C6 CT C8 C9 CA CB. (CC CD. CE CE 
Nonce - 00 00 00 06 05 04 03 AO A1A2 A3 A4 A5 
Total packet length - 31. [Input (12 cleartext header octets)] 

00 01 02 03 04050607 08 090A OB OC OD OE OF 

10 11 12 13 141516317 18 19 1A 1B 1C 1D IE 
CBC IV in: 59 00 00 00 060504 03 AO Al A2 A3 A4 A5 00 13 
CBC IV out:F5 51 CF 6C 7C F7 DA OB 2B 76 F1 6B 57 FO 19 FE 
After xor: F5 5D CF 6D 7E F4 DO OE 2D 71 F9 62 5D FB 19 FE [hdr] 
After CAM: 02 2B 21 1B EB 97 02 3B F8 10 7D CC 62 14 E5 7C 
After xor: OE 26 2F 14 FB 86 1028 EC 05 6B DB 7A OD FF 67 [msg] 
After CAM: 48 14 A4 2D 31 25 1C 37 19 C5 6F DD 5A 37 81 42 
After xor: 54 09 BA 2D 3125 1C 37 19 C5 6F DD 5A 37 81 42 [msg] 
After CAM: CF 85 25 D2 80 D5 FO 09 53 2C 9D 43 4E F3 04 47 
MIC tag : CF 85 25 D2 80 D5 FO 09 
CTR Start: 01 00 00 00 060504 03 AO Al A2 A3 A4 A5 00 01 
CTR[0001]: C6 E2 10 8D 62 00 A2 9C 6F CC 19 1F DF 6B 92 DB 
CTR[0002]: 6C B9 BE EE 1E A2 E9 B3 2D D6 C2 9A E8 26 D5 C2 
CTR[MIC ]: 44 BF B6 E8 E3 31 67 AY 
Total packet length - 39. [Encrypted] 

00 01 02 03 04050607 08 09 OA OB CA EF 1E 82 

72 11 BO 8F 7B D9 OF 08 C7 72 88 CO 70 A4 AO 8B 

3A 93 3A 63 E4 97 AO 
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Packet Vector #5 


CAM Key: C0. Cl €2~C35 TGA -COI C6 .C7 C8. C9.CA CB CC CD- CE-CE 
Nonce - 00 00 00 07 06 05 04 AO Al A2 A3 A4 A5 
Total packet length = 32. [Input (12 cleartext header octets) ] 
00 01 02 03 04 05 06 07 08 09 0A OB OC OD OE OF 
L0-11 12 13. I4 15. r6 17 18. 19 IA 1B. IC 1D. IE IF 
CBC IV in: 59 00 00 00 07 06 05 04 AO Al A2 A3 A4 A5 00 14 
CBC IV out:73 72 9D 76 7A BD B9 82 60 3A 12 7B EF 26 FB 80 
After xor: 73 7E 9D 77 78 BE BD 87 66 3D 1A 72 E5 2D FB 80 [hdr] 
After CAM: El B7 A6 72 E2 5C 87 75 91 21 22 A4 07 13 CD 5B 


After xor: ED BA A8 7D F2 4D 95 66 85 34 34 B3 1F OA D7 40 [msg] 
After CAM: 13 2F 58 D9 5D OF 95 B8 90 BF 6F 1D 31 84 54 C7 
After xor: OF 32 46 C6 5D OF 95 B8 90 BF 6F 1D 31 84 54 C7 [msg] 
After CAM: 47 8F 1E BO 71 24 8B 13 AF C8 C8 44 E6 OF 88 BG 
MIC tag : 47 8F 1E BO 71 24 8B 13 
CTR Start: 01 00 00 00 07 06 05 04 AO Al A2 A3 A4 A5 00 01 
CTR[0001]: 26 DE B4 D6 5F D4 3C 81 AA 56 98 95 64 09 39 A2 
CTR[0002]: 76 97 69 3A 21 13 OC 39 2E 4E EB BF 48 7B 24 BE 
CTR[MIC ]: C8 2E 65 17 82 15 50 1A 
Total packet length - 40. [Encrypted] 

00 01 02 03 04 05 06 07 08 09 0A OB 2A D3 BA DY 

4F C5 2E 92 BE 43 8E 82 7C 10 23 B9 6A 8A 77 25 

8F Al 7B A7 F3 31 DB 09 


Packet Vector #6 


CAM Key: cO Cl C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF 
Nonce = 00 00 00 08 07 06 05 A0 A1 A2 A3 A4 A5 
Total packet length = 33. [Input (12 cleartext header octets) ] 


00 01 02 03 04050607 08 09 0A OB OC OD OE OF 

LO 11-12-13 .14 15 16 17 18 I9 1A 1B LC. 1D: TIE 1F 

20 
CBC IV in: 59 00 00 00 08 07 06 05 AO Al A2 A3 A4 A5 00 15 
CBC IV out:EB 59 05 CC 3F 52 61 10 26 24 75 93 DD B9 AO F4 
After xor: EB 55 05 CD 3D 51 65 15 20 23 7D 9A D7 B2 AO F4 [hdr] 
After CAM: 18 A9 AE A4 3D D2 A9 11 6C OA E5 4F 40 D1 4D 9F 
After xor: 14 A4 AO AB 2D C3 BB 02 78 1F F3 58 58 C8 57 84 [msg] 
After CAM: FA C4 13 18 98 54 1B 54 93 9C 64 B8 CB FD 5B 18 
After xor: E6 D9 OD 07 B8 54 1B 54 93 9C 64 B8 CB FD 5B 18 [msg] 
After CAM: 49 E6 E8 ED 32 FB CA 2F 2E 55 CD AF DO F2 B3 05 
MIC tag : 49 E6 E8 ED 32 FB CA 2F 
CTR Start: 01 00 00 00 08 07 06 05 AO Al A2 A3 A4 A5 00 01 
CTR[0001]: F2 A8 46 04 B5 2E BA CO D7 51 34 BD D6 54 FC 64 
CTR[0002]: E6 26 A9 24 8B E6 86 CB 92 D6 FB FC 2E F2 91 98 
CTR[MIC ]: E2 DO 49 03 7D 1B 34 07 
Total packet length - 41. [Encrypted] 

00 01 02 03 04050607 08 09 OA OB FE A5 48 OB 

A5 3F A8 D3 C3 44 22 AA CE 4D E6 7F FA 3B B7 3B 

AB AB 36 Al EE 4F EO FE 28 
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Packet Vector #7 
CAM Key: C0. Cl (€2-—C3. TGA GI C6:..C7.. a /C9 CA. CB: CC CD CE-CE 
Nonce - 00 00 00 09 08 07 06 AO Al A2 A3 A4 A5 
Total packet length = 31. [Input (8 cleartext header octets) ] 

00 01 02 03 04050607 08 09 OA OB OC OD OE OF 

10-11 12 13. I4 15. T6 17 18-19 1A 1B. 1C ID IE 
CBC IV in: 61 00 00 00 09 08 07 06 AO Al A2 A3 A4 AS 00 17 
CBC IV out:AC F1 5D 79 99 1A 15 BF 5C DC F6 C4 45 AE 1F CB 
After xor: AC F9 5D 78 9B 19 11 BA 5A DB F6 C4 45 AE 1F CB [hdr] 
After CAM: E9 CO AC FD C7 E8 E7 1D FA E8 8B 66 295 9E 01 45 
After xor: El C9 A6 F6 CB E5 E9 12 EA F9 99 75 81 8B 17 52 [msg] 
After CAM: 9C FF ED 72 09 A6 7D 2A 48 B7 29 BF D8 BE 39 59 
After xor: 84 E6 F7 69 15 BB 63 2A 48 B7 29 BF D8 BE 39 59 [msg] 
After CAM: 4F 41 FA DE B2 58 F3 32 54 0A 55 7A 80 4A A3 F5 
MIC tag : 4F 41 FA DE B2 58 F3 32 54 OA 
CTR Start: 01 00 00 00 09 08 07 06 AO Al A2 A3 A4 AS 00 01 
CTR[0001]: 5C 5A 2A 2D E9 41 1F 95 9D 27 CB FF 7A OB CF 63 
CTR[0002]: OE D1 6A 97 57 41 32 4F 33 1B 4A 42 B1 4A 54 63 
CTR[MIC ]: E3 EE 59 62 7D 22 BD 8D Cl 79 
Total packet length - 41. [Encrypted] 

00 01 02 03 04050607 54 53 2026 E5 4C 11 9A 

8D 36 D9 EC 6E 1E D9 74 16 C8 70 8C 4B 5C 2C AC 

AF A3 BC CF 7A 4E BF 95 73 


Packet Vector #8 


CAM Key: CO Cl C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF 
Nonce = 00 00 00 OA 09 08 07 A0 Al A2 A3 A4 A5 
Total packet length = 32. [Input (8 cleartext header octets) ] 
00 01 02 03 04 05 06 07 08 09 0A OB OC OD OE OF 
10 11 12 13 14151617 18 19 1A 1B 1C 1D 1E 1F 
CBC IV in: 61 00 00 00 OA 09 08 07 AO Al A2 A3 A4 A5 00 18 
CBC IV out:AD CA 1C 1D 45 E7 E2 62 58 D5 DA 46 D8 2F 69 3A 
After xor: AD C2 1C 1C 47 E4 E6 67 5E D2 DA 46 D8 2F 69 3A [hdr] 
After CAM: FA DE OE B4 3E CA C1 E9 69 BB 8C A4 7C OD 80 8F 
After xor: F2 D7 04 BF 32 C7 CF E6 79 AA 9E B7 68 18 96 98 [msg] 


After CAM: D2 87 35 C2 DO E4 AE 4E BC C2 99 FF B3 77 F8 Al 
After xor: CA 9E 2F D9 CC F9 BO 51 BC C2 99 FF B3 77 F8 Al [msg] 
After CAM: BD F6 FB 55 9E 90 CO E7 DF 4B 0C 37 DC 42 32 A2 
MIC tag : BD F6 FB 55 9E 90 CO E7 DF 4B 
CTR Start: 01 00 00 00 OA 09 08 07 AO Al A2 A3 A4 AS 00 01 
CTR[0001]: 82 D8 91 OB 16 8A DF 47 E4 C8 39 FC 20 47 4A DB 
CTR[0002]: FB BF 26 7E OE BB EB 6A 07 4E 29 CF 3D 12 E6 DB 
CTR[MIC ]: CE 7E 1F C4 A0 61 87 E6 2B OA 
Total packet length - 42. [Encrypted] 
00 01 02 03 04050607 8AD19B 00 1A 87 D1 48 
F4 D9 2B EF 34 52 5C CC E3 A6 3C 65 12 A6 F5 75 
73 88 E4 91 3E F1 47 01 F4 41 
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Packet Vector #9 


CAM Key: CO C1C2C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF 
Nonce - 00 00 00 0B OA 09 08 AO Al A2 A3 A4 A5 
Total packet length = 33. [Input (8 cleartext header octets) ] 


00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 

L0-l1 12 I3. 4 To: Le 17 18 19 1A IB. IC-ID: TE Le 

20 
CBC IV in: 61 00 00 00 OB OA 09 08 AO Al A2 A3 A4 A5 00 19 
CBC IV out:DO A9 A5 94 00 63 86 40 11 OD DB 40 CA F8 4A 9C 
After xor: DO Al A5 95 02 60 82 45 17 OA DB 40 CA F8 4A 9C [hdr] 
After CAM: 7B CA 4E 2D 79 82 OD 1E 15 22 DD E8 37 B9 B1 FO 
After xor: 73 C3 44 26 75 8F 03 11 05 33 CF FB 23 AC A7 E7 [msg] 
After CAM: 6B 75 9F 83 CO 8F 56 64 F2 FA D5 7F 67 01 B8 21 
After xor: 73 6C 85 98 DC 92 48 7B D2 FA D5 7F 67 01 B8 21 [msg] 
After CAM: 7D B7 BE FF 72 F3 26 74 9E 20 07 28 1E 5B 1A 8A 
MIC tag : 7D B7 BE FF 72 F3 26 74 9E 20 
CTR Start: 01 00 00 00 OB OA 09 08 AO Al A2 A3 A4 A5 00 01 
CTR[0001]: 55 B9 87 69 4C 73 60 3E C6 1E 8E B1 D2 11 62 36 
CTR[0002]: 82 D9 A4 4B DC C9 BB 68 A7 FE 15 A5 19 51 57 87 
CTR[MIC ]: E9 61 5C CF BF D6 EF 8A 21 A7 
Total packet length = 43. [Encrypted] 

00 01 02 03 04050607 5D BO 8D 62 40 7E 6E 31 

D6 OF 9C A2 C6 04 74 21 9A CO BE 50 CO D4 A5 77 

87 94 D6 E2 30 CD 25 C9 FE BF 87 


Packet Vector #10 


CAM Key: CO C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF 
Nonce - 0000000 0C 0B 0A 09 A0 A1 A2 A3 A4 A5 
Total packet length - 31. [Input (12 cleartext header octets)] 


00010203 04050607 08 09 0A OB OC OD OE OF 
10111213 14 15 16 17 18 19 1A 1B 1C 1D 1E 
CBC IV in: 61 00 00 00 OC OB 0A 09 AO Al A2 A3 A4 A5 00 13 
CBC IV out:Bl 85 73 A3 1C 6F EC 01 90 E3 CE 94 27 11 04 B9 
After xor: Bl 89 73 A2 1E 6C EB 04 96 E4 C6 9D 2D 1A 04 B9 [hdr] 
After CAM: A6 AD EA 9C FA 3F 76 78 4C 17 8A F3 DC 69 FO 82 
After xor: AA AO E4 93 EA 2E 64 6B 58 02 9C E4 C4 70 EA 99 [msg] 
After CAM: 35 50 B7 27 78 F8 C6 BF 02 4B 65 60 05 CO El ED 
After xor: 29 4D A9 27 78 F8 C6 BF 02 4B 65 60 05 CO El ED [msg] 
After CAM: 3D B5 A6 E6 85 AF 1C 58 80 BO 32 2E 01 74 91 FC 
MIC tag : 3D B5 A6 E6 85 AF 1C 58 380 BO 
CTR Start: 01 00 00 00 OC OB OA 09 AO Al A2 A3 A4 AS 00 01 
CTR[0001]: D7 1C 82 C1 D1 A9 64 OF 93 69 CE 81 22 7E CC E8 
CTR[0002]: A7 Al 42 44 32 4E 69 FE 4C DO 36 65 A5 31 OB AB 
CTR[MIC ]: ED 27 3F OD 94 5C OE AA B2 87 
Total packet length = 41. [Encrypted] 
00 01 02 03 04 05 06 07 08 09 0A 0B DB 11 8C CE 
C1 B8 76 1C 87 7C D8 96 3A 67 D6 F3 BB BC 5C DO 
92 99 EB 11 F312 F2 32 37 
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Packet Vector #11 

CAM Key: C0. Cl C2. C3 C4 C5. C6 C7  C8.C9.CA CB CC CD CE-CE 
Nonce - 00 00 00 OD OC OB OA AO A1A2 A3 A4 A5 
Total packet length = 32. [Input (12 cleartext header octets) ] 

00 01 02 03 04 05 06 07 08 09 0A 0B OC OD OE OF 

L0-11 AD 13. 4 ES LE LY I8. 19 IA LB) PC. ID IE IF 
CBC IV in: 61 00 00 00 OD OC OB OA AO Al A2 A3 A4 A5 00 14 
CBC IV out:45 DF B5 07 6F BB 10 EA F115 15 AD 21 4F BO OE 
After xor: 45 D3 B5 06 6D B8 14 EF F7 12 1D A4 2B 44 BO OE [hdr] 
After CAM: 17 52 F9 6D DD BC 5B 1C 1E EB 80 FC F6 10 AC 03 
After xor: 1B 5F F7 62 CD AD 49 OF OA FE 96 EB EE 09 B6 18 [msg] 
After CAM: BE F0 A0 B9 EC 94 B6 B3 E8 EC 1B 82 14 14 09 87 
After xor: A2 ED BE A6 EC 94 B6 B3 E8 EC 1B 82 14 14 09 87 [msg] 
After CAM: 70 16 E4 F9 C4 2C 30 10 84 BF EC 69 34 89 91 FD 
MIC tag 70 16 E4 F9 C4 2C 30 10 84 BF 
CTR Start: 01 00 00 00 OD OC OB OA AO Al A2 A3 A4 A5 00 O1 
CTR[0001]: 70 C5 33 82 D4 80 11 41 4F 5D 2B D2 D2 67 B3 BO 
CTR[0002]: 9D 36 6E 49 39 C5 16 76 5C 1C 25 12 81 79 94 70 
CTR[MIC ]: 77 8B 4B 03 1E 3A FC DF A8 F1 
Total packet length = 42. [Encrypted] 

00 01 02 03 04 05 06 07 08 09 0A 0B 7C C8 3D 8D 

C4 91 03 52 5B 48 3D C5 CA 7E A9 AB 81 2B 70 56 

07 9D AF FA DA 16 CC CF 2C 4E 

Packet Vector #12 

CAM Key: CO C1C2C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF 
Nonce - 00 00 00 OF OD OC OB AO Al A2 A3 A4 A5 
Total packet length = 33. [Input (12 cleartext header octets) ] 

00 01 02 03 04 05 06 07 08 09 0A 0B OC OD OE OF 

L0 11-12-13 .14 15 16 17 18 I9 1A. JB TCID, TIE IF 

20 
CBC IV in: 61 00 00 00 OE OD OC OB AO Al A2 A3 A4 A5 00 15 
CBC IV out:81 E4 EB IE 50 A9 70 CE 18 CA 1A 4B 68 39 80 2E 
After xor: 81 E8 EB 1F 52 AA 74 CB 1E CD 12 42 62 32 80 2E [hdr] 
After CAM: 04 AB D9 62 34 B9 8F 32 8C OF 08 3F 3D 87 9D 57 
After xor: 08 A6 D7 6D 24 A8 9D 21 98 1A 1E 28 25 9E 87 4C [msg] 
After CAM: BD A2 EA CB 3A DA 6A E7 9F BB C2 2C E6 4C 98 89 
After xor: Al BF F4 D4 1A DA 6A E7 9F BB C2 2C E6 4C 98 89 [msg] 
After CAM: B6 FC El 46 D3 EA DC 91 EO AB 10 AD D8 55 E7 03 
MIC tag B6 FC E1 46 D3 EA DC 91 EO AB 
CTR Start: 01 00 00 00 OE OD OC OB AO Al A2 A3 A4 A5 00 01 
CTR[0001]: 20 DE 55 87 30 C3 2C 69 B7 44 A6 FE 37 DE 89 7C 
CTR[0002]: 3F 96 32 D8 68 6D C2 B5 22 97 42 27 EB F9 26 5E 
CTR[MIC ]: 7D 45 AD 6F 94 93 E1 F5 4F DE 
Total packet length - 43. [Encrypted] 

00 01 02 03 04 05 06 07 08 09 0A 0B 2C D3 5B 88 

20 D2 3E 7A A3 51 BO E9 2F C7 93 67 23 8B 2C C7 

48 CB B9 4C 29 47 79 3D 64 AF 75 
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Packet Vector #13 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 A9 70 11 OF 19 27 B1 60 B6 A3 1C 1C 
Total packet length - 31. [Input (8 cleartext header octets)] 


6B 7F 46 45 07 FA E4 96 C6 B5 F3 E6 CA 23 11 AE 

F7 47 2B 20 3E 73 5E A5 61 AD B1 7D 56 C5 A3 
CBC IV in: 59 00 A9 70 11 OE 19 27 B1 60 B6 A3 1C 1C 00 17 
CBC IV out:D7 24 BO OF B1 87 04 C6 Cl 4E 9037 AA F2 F1 F9 
After xor: D7 2C DB 70 F7 C2 03 3C 25 D8 90 37 AA F2 F1 F9 [hdr] 
After CAM: 9B 13 6D E3 D9 9F C3 6D 7D OD B7 D8 Al BF EY BD 
After xor: 5D A6 9E 05 13 BC D2 C3 8A 4A 9C F8 O9F CC B7 18 [msg] 
After CAM: F8 BF 25 7D 23 F8 D9 B5 82 E6 C9 3E C8 9B 85 73 
After xor: 99 12 94 00 75 3D 7A B5 82 E6 C9 3E C8 9B 85 73 [msg] 
After CAM: D9 D6 62 21 6D B2 CA FD 1F C6 FE 9D 2C AF 5B 69 
MIC tag : D9 D6 62 21 6D B2 CA FD 
CTR Start: 01 00 A9 70 11 OE 19 27 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 62 80 24 Cl FE AE CC 8C 67 38 55 98 CB 8E E5 E8 
CTR[0002]: F2 30 17 2F 1B 71 55 9F 8B CE 79 E5 13 01 FC 6A 
CTR[MIC ]: 9C 8E A2 OC 48 03 ED 13 
Total packet length = 39. [Encrypted] 

6B 7F 46 45 07 FA E4 96 A4 35 D7 27 34 8D DD 22 

90 7F 7E B8 F5 FD BB 4D 93 9D A6 52 4D B4 F6 45 

58 CO 2D 25 B1 27 EE 


Packet Vector #14 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 83 CD 8C EO CB 42 B1 60 B6 A3 1C 1C 
Total packet length - 32. [Input (8 cleartext header octets)] 


98 66 05 B4 3D F1 5D E7 01 F6 CE 67 64 C5 74 48 

3B BO 2E 6B BF 1E OA BD 26 A2 25 72 B4 D8 OE E7 

CBC IV in: 59 00 83 CD 8C EO CB 42 B1 60B6 A3 1C 1C 00 18 

CBC IV out:A0 8A 29 78 36 23 1D 84 96 76 93 F OA 4C 92 7A 
After xor: AO 82 B1 1E 33 97 20 75 CB 91 93 F OA 4C 92 7A [hdr] 

After CAM: 8C F5 F4 23 BF 09 1C 74 CD 47 00 C1 32 5D 5C 92 
After xor: 8D 03 3A 44 DB CC 68 3C F6 F7 2E AA 8D 43 56 2F [msg] 

After CAM: 69 DA 48 24 41 1E AC 8E A9 OA CD 8B DD 00 2B 9A 
After xor: 4F 78 6D 56 F5 C6 A2 69 A9 OA CD 8B DD 00 2B 9A [msg] 
After CAM: C2 03 3B 08 6D B3 CB 3B 2C C8 5D E7 76 Al CO 44 
6D 
8C 


MIC tag : C2 03 3B 08 B3 CB 3B 
CTR Start: 01 00 83 CD EO CB 42 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 8B 16 9C 37 EB 7B BE DB 15 84 41 6E 5F C2 07 46 
CTR[0002]: E9 31 BB DD 4E E6 56 9B 68 95 13 5F AB A4 DF EF 
CTR[MIC ]: 44 7E 55 14 25 C3 F3 3D 
Total packet length - 40. [Encrypted] 
98 66 05 B4 3D F1 5D E7 8A E0 52 50 8F BE CA 93 
2E 34 6F 05 EO DC OD FB CF 93 9E AF FA 3E 58 7C 
86 7D 6E 1C 48 70 38 06 
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Packet Vector #15 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 SF 54 95 OB 18 F2 B1 60 B6 A3 1C 1C 
Total packet length = 33. [Input (8 cleartext header octets) ] 


48 F2 E7 El A7 67 1A 51 CD F1 D8 40 6F C2 E9 01 
49 53 89 70 05 FB FB 8B A5 72 76 F9 24 04 60 8E 
08 
CBC IV in: 59 00 5F 54 95 0B 18 F2 B1 60 B6 A3 1C 1C 00 19 
CBC IV out:76 74 53 37 95 23 3C FO EB 77 CE 93 73 06 99 A8 
After xor: 76 7C 1B C5 72 C2 9B 97 F1 26 CE 93 73 06 99 A8 [hdr] 
After CAM: EF 79 8B 70 34 E4 D5 6B 57 3A F9 44 FO AF D6 9A 
After xor: 22 88 53 30 5B 26 3C 6A 1E 69 70 34 F5 54 2D 11 [msg] 
After CAM: 63 BF 4E 10 01 79 38 OB E4 EC C1 39 B2 B4 3B 8C 
After xor: C6 CD 38 E9 25 7D 58 85 EC EC C1 39 B2 B4 3B 8C [msg] 
After CAM: 39 El OE FA BD 2F 43 00 50 9E E7 EB A4 FF 6B 8F 
MIC tag : 39 El OE FA BD 2F 43 00 
CTR Start: 01 00 5F 54 95 OB 18 F2 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: C5 47 A6 A2 73 49 1B 6F OE 6D C9 F5 9C 12 3B 08 
CTR[0002]: C8 18 86 42 3C DB 35 C8 64 4D 8C 4C 58 01 47 27 
CTR[MIC ]: 91 E9 76 5D 2D 68 2E E5 
Total packet length - 41. [Encrypted] 
48 F2 E7 El A7 67 1A 51 08 B6 7E E2 1C 8B F2 6E 
47 3E 4085 99 E9 CO 83 6D 6A FO BB 18 DF 55 46 
6C A8 08 78 A7 90 47 6D E5 


Packet Vector #16 


CAM Key: D7 5C 27 78 07 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 EC 60 08 63 31 9A B1 60 B6 A3 1C 1C 
Total packet length - 31. [Input (12 cleartext header octets)] 


DE 97 DF 3B 8C BD 6D 8E 50 30 DA 4C BO 05 DC FA 

0B 59 18 14 26 A9 61 68 5A 99 3D 8C 43 18 5B 
CBC IV in: 59 00 EC 60 08 63 31 9A B1 60 B6 A3 1C 1C 00 13 
CBC IV out:78 EE 05 5A 88 48 E3 5B 8A 45 46 8F 35 4F OC A2 
After xor: 78 E2 DB CD 57 73 6F E6 E7 CB 16 BF EF 03 OC A2 [hdr] 
After CAM: A9 C6 7F 15 00 1A C6 92 81 67 BD EC DF D2 35 C9 
After xor: 19 C3 A3 EF OB 43 DE 86 A7 CE DC 84 85 4B 08 45 [msg] 
After CAM: 7C A8 9C 90 46 42 4B E2 4D 96 DF CF BA 12 FD 18 
After xor: 3F BO C7 90 46 42 4B E2 4D 96 DF CF BA 12 FD 18 [msg] 
After CAM: 89 C7 B4 E8 A4 24 8C 6C 52 ED 34 50 E3 53 AD F5 
MIC tag : 89 C7 B4 E8 A4 24 8C 6C 
CTR Start: 01 00 EC 60 08 63 31 9A B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: D3 B2 57 B3 6C E8 86 CF 91 9A AC 79 4E 6F 73 S3E 
CTR[0002]: 65 10 C8 72 39 AF OF 52 9F DO A4 DF 54 BF D6 EB 
CTR[MIC ]: El 04 EO 6A 29 B1 80 A9 
Total packet length - 39. [Encrypted] 

DE 97 DF 3B 8C BD 6D 8E 50 30 DA 4C 63 B7 8B 49 

67 Bl 9E DB B7 33 CD 11 14 F6 4E B2 26 08 93 68 

C3 54 82 8D 95 0C C5 
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Packet Vector 417 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 60 CF F1 A3 IE Al B1 60 B6 A3 1C 1C 
Total packet length - 32. [Input (12 cleartext header octets)] 


A5 EE 93 E4 57 DF 05 46 6E 78 2D CF 2E 20 21 12 

98 10 5F 12 9D 5E D9 5B 93 F7 2D 30 B2 FA CC D7 
CBC IV in: 59 00 60 CF F1 A3 IE Al B1 60 B6 A3 1C 1C 00 14 
CBC IV out:C3 34 69 7D 11 38 73 06 BD 34 E2 10 1F 66 17 E8 
After xor: C3 38 CC 93 82 DC 24 D9 B8 72 8C 68 32 A9 17 E8 [hdr] 
After CAM: 43 6F 37 74 AB 94 3B 41 EA AD 00 CA C3 99 13 7B 
After xor: 6D 4F 16 66 33 84 64 53 77 F3 D9 91 50 6E 3E 4B [msg] 
After CAM: 2D 28 FB 62 DA 06 97 A7 4C D4 31 B8 B5 AE AE EE 
After xor: 9F D2 37 B5 DA 06 97 A7 4C D4 31 B8 B5 AE AE EE [msg] 
After CAM: F3 DE 10 CD 91 4D B1 B6 CC 37 FO A2 4A 5A B7 Al 
MIC tag : F3 DE 10 CD 91 4D B1 B6 
CTR Start: 01 00 60 CF F1 A3 IE A1 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 25 E6 9A FO 30 A9 56 E6 FF CO 3F 87 87 7A 89 74 
CTR[0002]: A2 1B 46 23 76 A2 1E DD F2 AC 4B EC 42 95 3D D3 
CTR[MIC ]: C2 99 28 FF E7 BB DB 29 
Total packet length - 40. [Encrypted] 

A5 EE 93 E4 57 DF 05 46 6E 78 2D CF OB C6 BB E2 

A8 B9 09 F4 62 9E E6 DC 14 8D A4 44 10 E1 8A F4 

31.47 38 32 76 F6 6A 9F 


Packet Vector #18 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 OF 85 CD 99 5C 97 B1 60 B6 A3 1C 1C 
Total packet length - 33. [Input (12 cleartext header octets)] 


24 AA 1B F9 A5 CD 87 61 82 A2 5074 26 45 94 1E 

75 63 2D 34 91 AF OF CO C9 87 6C 3B E4 AA 74 68 

C9 
CBC IV in: 59 00 OF 85 CD 99 5C 97 B1 60 B6 A3 1C 1C 00 15 
CBC IV out:72 0A 46 75 OF 40 59 53 F2 3B D2 1F 6A 11 60 F6 
After xor: 72 06 62 DF 14 B9 FC 9E 75 5A 50 BD 3A 65 60 F6 [hdr] 
After CAM: 67 73 AO FD D5 7E D3 5E E8 24 06 DO Al 8B OE 18 
After xor: 41 36 34 E3 AO 1D FE 6A 79 8B 09 10 68 OC 62 23 [msg] 
After CAM: BB 1E D8 9F 60 29 D099 09 14 06 A5 E3 8B 72 7B 
After xor: 5F B4 AC F7 A9 29 DO 99 09 14 06 A5 E3 8B 72 7B [msg] 
After CAM: 3E 4F 40 73 D1 31 E9 B8 02 C8 99 BC FD AC 19 4B 
MIC tag : 3E 4F 40 73 D1 31 E9 B8 
CTR Start: 01 00 OF 85 CD 99 5C 97 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 04 6F 42 2C 8F 52 FB 9B 06 A3 3B 9F B7 FO A6 00 
CTR[0002]: 34 76 51 DB 89 10 FB E6 73 E8 56 6E DB 66 47 5D 
CTR[MIC ]: 9F EC 93 6C 5C 7A AD OF 
Total packet length - 41. [Encrypted] 

24 AA 1B F9 A5 CD 87 61 82 A2 50 74 22 2A D6 32 

FA 31 D6 AF 97 0C 34 5F 7E 77 CA 3B DO DC 25 B3 

40 Al A3 D3 1F 8D 4B 44 B7 
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CAM Key: D7 5C 27 78 07 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 C2 9B 2C AA C4 CD B1 60 B6 A3 1C 1C 
Total packet length - 31. [Input (8 cleartext header octets)] 

69 19 46 B9 CA 07 BE 87 07 01 35 A6 43 7C 9D B1 

20 CD 61 D8 F6 C3 9C 3E A125 FD 95 AO D2 3D 
CBC IV in: 61 00 C2 9B 2C AA C4 CD B1 60 B6 A3 1C 1C 00 17 
CBC IV out:74 AD F8 04 05 2A 48 E7 46 97 38 D5 BA A1 27 79 
After xor: 74 A5 91 1D 43 93 82 EO F8 10 38 D5 BA Al 27 79 [hdr] 
After CAM: BD C3 B1 41 1C 64 C8 BB A9 DC 6A 94 78 97 88 E2 
After xor: BA C2 84 E7 5F 18 55 02 89 11 OB 4C 8E 54 14 DC [msg] 
After CAM: 7D 6C 8A BF AD 68 48 D8 C5 FB CD 1E AF F2 44 99 
After xor: DC 49 77 2A OD BA 75 D8 C5 FB CD 1E AF F2 44 99 [msg] 
After CAM: 19 99 AB 92 5E 30 46 96 3D EF FB 1B 4C 87 F7 76 
MIC tag 19 99 AB 92 5E 30 46 96 3D EF 
CTR Start: 01 00 C2 9B 2C AA CA CD B1 60B6 A3 1C 1C 00 01 
CTR[0001]: 02 B9 D4 1F 87 EO 60 E7 EF DE 6B 7E D3 DE 5E D2 
CTR[0002]: 61 49 31 C5 2F 34 AA 47 A3 E4 D3 2C OB 36 41 C6 
CTR[MIC ]: B9 9F C6 C5 96 7B AA 8E 1A 87 
Total packet length - 41. [Encrypted] 

69 19 46 B9 CA 07 BE 87 05 B8 El B9 C4 9C FD 56 

CF 13 0A A6 25 1D C2 EC CO 6C CC 50 8F E6 97 AO 

06 6D 57 C8 4B EC 18 27 68 

Packet Vector #20 

CAM Key: D7 5C 27 78 07 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 2C 6B 75 95 EE 62 B1 60 B6 A3 1C 1C 
Total packet length - 32. [Input (8 cleartext header octets)] 

DO C5 4E CB 84 62 7D C4 C8 CO 88 OE 6C 63 6E 20 

09 3D D6 59 42 17 D2 E1 88 77 DB 26 4E 71 A5 CC 
CBC IV in: 61 00 2C 6B 75 95 EE 62 B1 60 B6 A3 1C 1C 00 18 
CBC IV out:35 A9 48 70 F9 BO C7 85 FB 32 1A D1 3C 8C A4 9A 
After xor: 35 Al 98 B5 B7 7B 43 E7 86 F6 1A D1 3C 8C A4 9A [hdr] 
After CAM: 0A 3C E3 OF AC 09 DC 5C 00105C 69 AC 19 F7 19 
After xor: C2 FC 6B 01 CO 6A B2 7C 09 2D 8A 30 EE OE 25 F8 [msg] 
After CAM: 61 CD 80 DO 72 E6 84 El BF El 4A 00 27 2A 4D 96 
After xor: E9 BA 5B F6 3C 97 21 2D BF El 4A 00 27 2A 4D 96 [msg] 
After CAM: E5 F9 F2 AB 47 FD 7B 8D 6F 72 FA 72 74 D7 69 BB 
MIC tag E5 F9 F2 AB 47 FD 7B 8D 6F 72 
CTR Start: 01 00 2C 6B 75 95 EE 62 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 9C OE 31 66 B2 81 58 31 5E 63 16 5A 9D BD CE 35 
CTR[0002]: 00 3E 66 D3 EO 5F 7E A7 EF C8 9A 5F DD 39 E3 54 
CTR[MIC ]: 9A 5E 87 1A 17 10 38 OE AA DB 
Total packet length - 42. [Encrypted] 

DO C5 4E CB 84 62 7D C4 54 CE B9 68 DE E2 36 11 

57 5E CO 03 DF AA 1C D4 88 49 BD F5 AE 2E DB 6B 

7F A7 75 B1 50 ED 43 83 C5 A9 
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Packet Vector #21 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 C5 3C D4 C2 AA 24 B1 60 B6 A3 1C 1C 
Total packet length - 33. [Input (8 cleartext header octets)] 


E2 85 EO E4 80 8C DA 3D F7 5D AA 07 10 C4 E6 42 

97 79 4D C2 B7 D2 A2 07 57 B1 AA 4E 44 80 02 FF 

AB 
CBC IV in: 61 00 C5 3C D4 C2 AA 24 B1 60B6 A3 1C 1C 00 19 
CBC IV out:2A 3C 23 B2 43 F5 1C 35 F7 79 5A CB 3B 20 21 2F 
After xor: 2A 34 C137 A3 11 9C B9 2D 44 5A CP GB 20 21 2F [hdr] 
After CAM: Al 7E AD 4C EE AB 5121 1D 2A 32 F2 D4 45 A6 D6 
After xor: 56 23 07 4B FE 6F B7 63 8A 53 7F 30 63 97 04 D1 [msg] 
After CAM: A9 Al 32 55 8F C6 9B 98 A9 CC 23 96 FE CA 84 EB 
After xor: FE 1098 1B CB 46 99 67 02 CC 23 96 FE CA 84 EB [msg] 
After CAM: 6A 5E 04 42 D1 A5 7E 17 29A 6C 8B 56 F7 19 80 C5 
MIC tag : 6A 5E 04 42 D1 A5 7E 17 9A 6C 
CTR Start: 01 00 C5 3C D4 C2 AA 24 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 46 1D EF 41 AF A2 94 52 5D 51 AE CB 04 49 74 CD 
CTR[0002]: 29 2E 62 66 1B 66 9A 2B 97 72 6B 77 32 A8 DC 35 
CTR[MIC ]: B8 54 06 A2 6C 6F 93 37 8A BF 
Total packet length - 43. [Encrypted] 

E2 85 EO E4 80 8C DA 3D B1 40 45 46 BF 66 72 10 

CA 28 E3 09 B3 9B D6 CA 7E 9F C8 28 SF E6 98 D4 

3C D2 OA 02 EO BD CA ED 20 10 D3 


Packet Vector #22 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 BE E9 26 7F BA DC B1 60 B6 A3 1C 1C 
Total packet length - 31. [Input (12 cleartext header octets)] 


6C AE F9 94 11 41 57 OD 7C 81 34 05 C2 38 82 2F 

AC 5F 98 FF 92 94 05 BO AD 12 7A 4E 41 85 4E 
CBC IV in: 61 00 BE E9 26 7F BA DC B1 60 B6 A3 1C 1C 00 13 
CBC IV out:20 60 6A D1 El A0 84 52 2F A3 8B F4 88 1D D6 8B 
After xor: 20 6C 06 7F 18 34 95 13 78 AE F7 75 BC 18 D6 8B [hdr] 
After CAM: 71 FD FF E7 D9 C8 95 75 D3 EC OB 7 7B 8B BE E7 
After xor: B3 C5 7D C8 75 97 0D 8A 41 78 OEC D6 99 C4 A9 [msg] 
After CAM: CA AD 93 9C 59 BA 40 AA 1A OB 88 1B EE 3D 3C 65 
After xor: 8B 28 DD 9C 59 BA 40 AA 1A OB 88 1B EE 3D 3C 65 [msg] 
After CAM: DC 48 8F AA 9C 75 E7 03 17 56 C2 C7 48 48 8D 1B 
MIC tag : DC 48 8F AA 9C 75 E7 03 17 56 
CTR Start: 01 00 BE E9 26 7F BA DC Bl 60 B6 A3 1C 1C 00 01 
CTR[0001]: 56 FO 17 B3 BD 09 02 D6 EA A5 A2 91 AD 4A 2D E5 
CTR[0002]: 20 3D 34 21 EF 5B F8 FC 7B 21 5C 76 7B A5 21 A6 
CTR[MIC ]: F1 A2 86 9C 2A 9E B8 61 48 OB 
Total packet length - 41. [Encrypted] 

6C AE F9 94 11 41 57 0D 7C 81 34 05 94 C8 95 9C 

11 56 9A 29 78 31 A7 21 0058 57 AB 61 B8 7A 2D 
EA 09 36 B6 EB 5F 62 5F 5D 
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Packet Vector #23 


CAM Key: D7 5C 27 78 O7 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 DF A8 B1 24 5007 B1 60 B6 A3 1C 1C 
Total packet length - 32. [Input (12 cleartext header octets)] 


36 A5 2C F1 6B 19 A2 03 7A B7 01 1E 4D BF 3E 77 
4A D2 45 E5 D5 89 1F 9D 1C 32 AO AE 02 2C 85 D7 
CBC IV in: 61 00 DF A8 B124 5007 B1 60 B6 A3 1C 1C 00 14 
CBC IV out:78 FD B6 AF 61 9E 1C 8D 82 41 17 A8 73 60 1B 70 
After xor: 78 F1 800A 4D 6F 77 94 20 42 6D 1F 72 7E 1B 70 [hdr] 
After CAM: 62 2E 28 65 92 43 DB 82 88 79 09 1E A7 24 54 67 
After xor: 2F 91 16 12 D8 91 9E 67 5D FO 16 83 BB 16 F4 C9 [msg] 
After CAM: 95 OF 52 08 FF 16 70 8C 1E D9 BB 06 GE 1E 41 CF 
After xor: 97 22 D7 DF FF 16 70 8C 1E D9 BB 06 GE 1E 41 CF [msg] 
After CAM: BA CD 51 FC 77 F4 02 8D 47 D5 7D 54 7D 46 33 4B 
MIC tag : BA CD 51 FC 77 F4 02 8D 47 D5 
CTR Start: 01 00 DF A8 B1 24 50 07 B1 60 B6 A3 1C 1C 00 01 
CTR[0001]: 15 D6 DD DD 98 96 39 91 35 75 1A 64 B8 D8 D4 F9 
CTR[0002]: 7D 61 6D 1D EB 92 00 2B 6F FA AB 53 BC AF 69 89 
CTR[MIC ]: 33 E9 27 BE El 59 06 9C DB 32 
Total packet length - 42. [Encrypted] 
36 A5 2C F1 6B 19 A2 03 7A B7 01 1E 58 69 E3 AA 
D2 44 7C 74 EO FC 05 F9 A4 EA 74 57  7F 4D E8 CA 
89 24 76 42 96 AD 04 11 9C E7 


Packet Vector #24 


CAM Key: D7 5C 27 78 07 8C A9 3D 97 1F 96 FD E7 20 F4 CD 
Nonce - 00 3B 8F D8 D3 A9 37 B1 60 B6 A3 1C 1C 
Total packet length - 33. [Input (12 cleartext header octets)] 


A4 D4 99 F7 84 19 72 8C 19 17 8B OC 9D C9 ED AE 
2F F5 DF 86 36 E8 C6 DE OE ED 55 F7 86 7E 33 33 
7D 


CBC IV in: 61 00 3B 8F D8 D3 A9 37 B1 60 B6 A3 1C 1C 00 15 

CBC IV out:84 E6 CF DD 6A 37 68 5D E6 71 AD 54 B3 BE FE B9 

After xor: 84 EA 6B 09 F3 CO EC 44 94 FD B4 43 38 B2 FE B9 [hdr] 
After CAM: C5 OF AO 62 20 18 F121 OE BC 3D 2E 47 B7 B8 C3 

After xor: 58 C6 4D CC OF ED 2E A7 38 54 FB FO 49 5A ED 34 [msg] 
After CAM: C4 6F 6D C3 17 3C 2A 7A 81 FC 2D DA  7F B7 C6 60 

After xor: 42 11 5E FO 6A 3C 2A 7A 81 FC 2D DA TF B7 C6 60 [msg] 
After CAM: DF AB 2E 76 BO 67 50 B3 7C DD 9A AC F3 79 17 71 

MIC tag : DF AB 2E 76 BO 67 50 B3 7C DD 

CTR Start: 01 00 3B 8F D8 D3 A9 37 B1 60 B6 A3 1C 1C 00 01 


CTR[0001]: D6 DO 6C F8 16 CE DO F1 AO EO AC 71 BA B9 AD 34 
CTR[0002]: 76 4A FF 9A 1B F8 55 1F 68 54 39 OA EE 37 24 28 
CTR[MIC ]: 4B F4 31 B8 17 86 4B 5D 16 F2 
Total packet length - 43. [Encrypted] 
A4 D4 99 F7 84 19 72 8C 19 17 8B OC 4B 19 81 56 
39 3B OF 77 96 08 6A AF B4 54 F8 C3 FO 34 CC A9 
66 94 BE 1F CE A7 El 1B EE 6A 2F 
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5. Security Considerations 
Camellia-CTR and Camellia-CCM employ CTR mode for confidentiality. 
For the security of CTR mode, refer to the Security Considerations of 
[16]. 
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